Elamur Research⌕
☰
home / papers / 2026 / Activation Decomposition and Steering for LLM Backdoor Remediation

Activation Decomposition and Steering for LLM Backdoor Remediation

Paper · 2026 · Lingfeng Zhong, Qiongkai Xu and Usman Naseem

Summary

LLMs fine-tuned on poisoned data can carry hidden backdoors that produce harmful output when a trigger appears. Most training-free defenses still need extra resources: a reference model, a safety-oriented dataset, or known triggers and poisoned samples. This paper introduces CS-ADS, which uses only the suspect model and the incoming prompt.

For each prompt, the method builds a "relieved" twin by prepending a friendly instruction. Both versions may still be triggered, but the twin is assumed to carry a larger share of benign signal. The method pre-decodes both and takes their activations at the BOS token. It models each activation as a linear mix of a benign component and a backdoored component, with different weights. A fixed-point iteration separates the two, and the benign direction is then added to token activations across the early-to-later layers during generation.

Against several state-of-the-art backdoor attacks, CS-ADS defends effectively. It beats steering baselines that rely on contrastive datasets and preserves more model utility. This makes low-cost remediation possible when clean data or auxiliary models are unavailable.

Key points

  • Unlike WAG, GSM, MSD, SANDE, WANDA and Cleangen, CS-ADS needs no additional training, reference model, safety-related dataset, or access to model parameters (Table 1).
  • Steering is applied to layers in the range [1, 0.8·L]. Decomposition uses BOS-position activations, following evidence that backdoor features gather at the start of the sequence.
  • The fixed-point algorithm alternately estimates the benign and poisoned components and recalibrates their mixing proportions (λ_r > λ_m). It stops once the change in their cosine similarity falls below a threshold, with a minimum of 20 iterations.
  • PCA of BOS activations for a CI-attacked Llama-2-7b at layer 30 shows that remediated samples move back toward the clean cluster.
  • The authors report several limitations:
    • Stronger backdoor mitigation comes with some loss of general utility.
    • Multimodal, CoT-based and weight-poisoning backdoors were not evaluated.
  • Code is available at github.com/lingfengzhong-mq/CS-ADS.

Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.

 Institutions

🎓Macquarie UniversitySydney · Australia44 works · 5,778 citations

 Fields, topics and concepts

📚 Shelves 4The field of science this work belongs to (OpenAlex fields).Computer Science · 18,614 worksArtificial Intelligence · 17,965 worksArts and Humanities · 17,450 worksLanguage and Linguistics · 17,296 works

🧭 Topics 1Research subjects and languages the work is about.Language models & pretraining · 3,894 works

Cite

Cite as Lingfeng Zhong, Qiongkai Xu and Usman Naseem. 2026. Activation Decomposition and Steering for LLM Backdoor Remediation. Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers).

The paper itself, not this page. BibTeX from the library's record of the work. DOI 10.18653/v1/2026.acl-long.2025

@inproceedings{zhong2026activation,
  title = {{Activation Decomposition and Steering for LLM Backdoor Remediation}},
  author = {Lingfeng Zhong, Qiongkai Xu and Usman Naseem},
  booktitle = {Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers)},
  year = {2026},
  doi = {10.18653/v1/2026.acl-long.2025},
  url = {https://doi.org/10.18653/v1/2026.acl-long.2025}
}

References

41 references, 11 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet.

  1. Andy Arditi, Oscar Obeso, Aaquib Syed, Daniel Paleka, Nina Panickssery, Wes Gurnee, and Neel Nanda. 2024. Refusal in language models is mediated by a single direction. In Advances in Neural Information Processing Systems 38: Annual Conference on Neural Information Processing Systems 2024, NeurIPS 20…
  2. Ansh Arora, Xuanli He, Maximilian Mozes, Srinibas Swain, Mark Dras, and Qiongkai Xu. 2024. Here’s a free lunch: Sanitizing backdoored models with model merge. In Findings of the Association for Computational Linguistics, ACL 2024, Bangkok, Thailand and virtual meeting, August 11-16, 2024, pages 1505… find
  3. Stella Biderman, Hailey Schoelkopf, Lintang Sutawika, Leo Gao, Jonathan Tow, Baber Abbasi, Alham Fikri Aji, Pawan Sasanka Ammanamanchi, Sidney Black, Jordan Clive, Anthony DiPofi, Julen Etxaniz, Benjamin Fattori, Jessica Zosa Forde, Charles Foster, Jeffrey Hsu, Mimansa Jaiswal, Wilson Y. Lee, Haonan… find
  4. Zouying Cao, Yifei Yang, and Hai Zhao. 2025. SCANS: mitigating the exaggerated safety for llms via safety-conscious activation steering. In AAAI-25, Sponsored by the Association for the Advancement of Artificial Intelligence, February 25 - March 4, 2025, Philadelphia, PA, USA, pages 23523–23531. AAA… find
  5. Peter Clark, Isaac Cowhey, Oren Etzioni, Tushar Khot, Ashish Sabharwal, Carissa Schoenick, and Oyvind Tafjord. 2018. Think you have solved question answering? try arc, the AI2 reasoning challenge. CoRR, abs/1803.05457.
  6. Kazuki Egashira, Robin Staab, Thibaud Gloaguen, Mark Vero, and Martin Vechev. 2026. Fewer weights, more problems: A practical attack on LLM pruning. In The Fourteenth International Conference on Learning Representations. find
  7. Xuanli He, Jun Wang, Qiongkai Xu, Pasquale Minervini, Pontus Stenetorp, Benjamin I. P. Rubinstein, and Trevor Cohn. 2025. TUBA: cross-lingual transferability of backdoor attacks in llms with instruction tuning. In Findings of the Association for Computational Linguistics, ACL 2025, Vienna, Austria,… find
  8. Dan Hendrycks, Collin Burns, Steven Basart, Andy Zou, Mantas Mazeika, Dawn Song, and Jacob Steinhardt. 2021. Measuring massive multitask language understanding. In 9th International Conference on Learning Representations, ICLR 2021, Virtual Event, Austria, May 3-7, 2021. OpenReview.net.
  9. Hai Huang, Zhengyu Zhao, Michael Backes, Yun Shen, and Yang Zhang. 2024. Composite backdoor attacks against large language models. In Findings of the Association for Computational Linguistics: NAACL 2024, Mexico City, Mexico, June 16-21, 2024, pages 1459–1472. Association for Computational Linguisti… find
  10. Yujin Huang, Terry Yue Zhuo, Qiongkai Xu, Han Hu, Xingliang Yuan, and Chunyang Chen. 2023. Training-free lexical backdoor attacks on language models. In Proceedings of the ACM Web Conference 2023, pages 2198–2208. find
  11. Keita Kurita, Paul Michel, and Graham Neubig. 2020. Weight poisoning attacks on pretrained models. In Proceedings of the 58th Annual Meeting of the Association for Computational Linguistics, pages 2793– 2806, Online. Association for Computational Linguistics.
  12. Bruce W. Lee, Inkit Padhi, Karthikeyan Natesan Ramamurthy, Erik Miehling, Pierre L. Dognin, Manish Nagireddy, and Amit Dhurandhar. 2025. Programming refusal with conditional activation steering. In The Thirteenth International Conference on Learning Representations, ICLR 2025, Singapore, April 24-28… find
  13. Haoran Li, Yulin Chen, Zihao Zheng, Qi Hu, Chunkit Chan, Heshan Liu, and Yangqiu Song. 2025a. Simulate and eliminate: Revoke backdoors for generative large language models. In AAAI-25, Sponsored by the Association for the Advancement of Artificial Intelligence, February 25 - March 4, 2025, Philadelp… find
  14. Fairsteer: Inference time debiasing for llms with dynamic activation steering. In Findings of the Association for Computational Linguistics, ACL 2025, Vienna, Austria, July 27 - August 1, 2025, pages 11293–11312. Association for Computational Linguistics. find
  15. Yuetai Li, Zhangchen Xu, Fengqing Jiang, Luyao Niu, Dinuka Sahabandu, Bhaskar Ramasubramanian, and Radha Poovendran. 2024. Cleangen: Mitigating backdoor attacks for generation tasks in large language models. In Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing, E… find
  16. Jiawei Liang, Siyuan Liang, Aishan Liu, and Xiaochun Cao. 2025. Vl-trojan: Multimodal instruction backdoor attacks against autoregressive visual language models. International Journal of Computer Vision, pages 1–20. find
  17. Alisa Liu, Maarten Sap, Ximing Lu, Swabha Swayamdipta, Chandra Bhagavatula, Noah A. Smith, and Yejin Choi. 2021. DExperts: Decoding-time controlled text generation with experts and anti-experts. In Proceedings of the 59th Annual Meeting of the Association for Computational Linguistics and the 11th I…
  18. Weimin Lyu, Lu Pang, Tengfei Ma, Haibin Ling, and Chao Chen. 2024. Trojvlm: Backdoor attack against vision language models. In European Conference on Computer Vision, pages 467–483. Springer. find
  19. Afrozah Nadeem, Mark Dras, and Usman Naseem. 2025. Steering towards fairness: Mitigating political stance bias in LLMs. In Proceedings of the 8th Workshop on Challenges and Applications of Automated Extraction of Socio-political Events from Texts, pages 52–61, Varna, Bulgaria. INCOMA Ltd., Shoumen,… find
  20. Narmeen Fatimah Oozeer, Dhruv Nathawani, Nirmal-endu Prakash, Michael Lan, Abir HARRASSE, and Amir Abdullah. 2025. Activation space interventions can be transferred between large language models. In Forty-second International Conference on Machine Learning. find
  21. OpenAI. 2024. Gpt-4o system card. abs/2410.21276.
  22. CoRR, Weijun Li, Ansh Arora, Xuanli He, Mark Dras, and Qiongkai Xu. 2026. Defending against backdoor attacks via module switching. In The Fourteenth International Conference on Learning Representations. find
  23. Kiho Park, Yo Joong Choe, and Victor Veitch. 2024. The linear representation hypothesis and the geometry of large language models. In Forty-first International Conference on Machine Learning, ICML 2024, Vienna, Austria, July 21-27, 2024. OpenReview.net.
  24. Yichen Li, Zhiting Fan, Ruizhe Chen, Xiaotang Gai, Luqi Gong, Yan Zhang, and Zuozhu Liu. 2025b. find
  25. Fanchao Qi, Yuan Yao, Sophia Xu, Zhiyuan Liu, and Maosong Sun. 2021. Turn the combination lock: Learnable textual backdoor attacks via word substitution. In Proceedings of the 59th Annual Meeting of the Association for Computational Linguistics and the 11th International Joint Conference on Natural… find
  26. Nina Rimsky, Nick Gabrieli, Julian Schulz, Meg Tong, Evan Hubinger, and Alexander Matt Turner. 2024. Steering llama 2 via contrastive activation addition. In Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), ACL 2024, Bangkok, Thailand,… find
  27. Morgane Rivière, Shreya Pathak, Pier Giuseppe Sessa, Cassidy Hardin, Surya Bhupatiraju, Léonard Hussenot, Thomas Mesnard, Bobak Shahriari, Alexandre Ramé, Johan Ferret, Peter Liu, Pouya Tafti, Abe Friesen, Michelle Casbon, Sabela Ramos, Ravin Kumar, Charline Le Lan, Sammy Jerome, Anton Tsitsulin, an… find
  28. Manli Shu, Jiongxiao Wang, Chen Zhu, Jonas Geiping, Chaowei Xiao, and Tom Goldstein. 2023. On the exploitability of instruction tuning. In Advances in Neural Information Processing Systems 36: Annual Conference on Neural Information Processing Systems 2023, NeurIPS 2023, New Orleans, LA, USA, Decemb… find
  29. Mingjie Sun, Zhuang Liu, Anna Bair, and J. Zico Kolter. 2024. A simple and effective pruning approach for large language models. In The Twelfth International Conference on Learning Representations, ICLR 2024, Vienna, Austria, May 7-11, 2024. OpenReview.net. find
  30. Rohan Taori, Ishaan Gulrajani, Tianyi Zhang, Yann Dubois, Xuechen Li, Carlos Guestrin, Percy Liang, and Tatsunori B Hashimoto. 2023. Stanford alpaca: an instruction-following llama model (2023). find
  31. Gemma Team. 2024a. Gemma: Open models based on gemini research and technology. CoRR, abs/2403.08295. find
  32. Llama Team. 2024b. The llama 3 herd of models. CoRR, abs/2407.21783.
  33. Yao Tong, Weijun Li, Xuanli He, Haolan Zhan, and Qiongkai Xu. 2025. Cut the deadwood out: Backdoor purification via guided module substitution. In Findings of the Association for Computational Linguistics: EMNLP 2025, pages 23760–23783, Suzhou, China. Association for Computational Linguistics. find
  34. Hugo Touvron, Louis Martin, Kevin Stone, Peter Albert, Amjad Almahairi, Yasmine Babaei, Nikolay Bashlykov, Soumya Batra, Prajjwal Bhargava, Shruti Bhosale, Dan Bikel, Lukas Blecher, Cristian Canton-Ferrer, Moya Chen, Guillem Cucurull, David Esiobu, Jude Fernandes, Jeremy Fu, Wenyin Fu, and 49 others… — Llama 2: Open Foundation and Fine-Tuned Chat Models
  35. Alexander Matt Turner, Lisa Thiergart, David Udell, Gavin Leech, Ulisse Mini, and Monte MacDiarmid. 2023. Activation addition: Steering language models without optimization. CoRR, abs/2308.10248.
  36. Haoran Wang and Kai Shu. 2024. Trojan activation attack: Red-teaming large language models using steering vectors for safety-alignment. In Proceedings of the 33rd ACM International Conference on Information and Knowledge Management, CIKM 2024, Boise, ID, USA, October 21-25, 2024, pages 2347– 2357. A… find
  37. Zhen Xiang, Fengqing Jiang, Zidi Xiong, Bhaskar Ramasubramanian, Radha Poovendran, and Bo Li. 2024. Badchain: Backdoor chain-of-thought prompting for large language models. In The Twelfth International Conference on Learning Representations, ICLR 2024, Vienna, Austria, May 7-11, 2024. OpenReview.net… find
  38. Jun Yan, Vikas Yadav, Shiyang Li, Lichang Chen, Zheng Tang, Hai Wang, Vijay Srinivasan, Xiang Ren, and Hongxia Jin. 2024. Backdooring instruction-tuned large language models with virtual prompt injection. In Proceedings of the 2024 Conference of the North American Chapter of the Association for Comp… find
  39. Zenghui Yuan, Yangming Xu, Jiawen Shi, Pan Zhou, and Lichao Sun. 2025. Merge hijacking: Backdoor attacks to model merging of large language models. In Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), ACL 2025, Vienna, Austria, July 27 -… find
  40. Yi Zeng, Weiyu Sun, Tran Ngoc Huynh, Dawn Song, Bo Li, and Ruoxi Jia. 2024. BEEAR: embedding-based adversarial removal of safety backdoors in instruction-tuned language models. In Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing, EMNLP 2024, Miami, FL, USA, Nove… find
  41. Lianmin Zheng, Wei-Lin Chiang, Ying Sheng, Siyuan Zhuang, Zhanghao Wu, Yonghao Zhuang, Zi Lin, Zhuohan Li, Dacheng Li, Eric P. Xing, Hao Zhang, Joseph E. Gonzalez, and Ion Stoica. 2023. Judging llm-as-a-judge with mt-bench and chatbot arena. In Advances in Neural Information Processing Systems 36: A…

Updated

↑ back to top

This page in Markdown → https://md.research.elamur.ai/free/en/papers/zhong-2026-activation-decomposition-steering-llm-backdoor/